Time-based input and output monitoring and analysis to predict future inputs and outputs

ABSTRACT

A monitoring system for detecting anomalous discharges stores input and output records, and fetches and discharges corresponding quantities to and from user resources. The output event records are discriminated for category attributes, and user-specific output category-specific metrics are aggregated for comparison to peer-representative output-category indexes. An alert is sent across a network connection for display on a user device upon determining the user-specific output category-specific metric diverges from the peer-representative output-category index. An alert, in some examples, indicates that the user-specific output category metric exceeds the peer-representative output-category index. Exposure of user-entity resources to outputs that are divergent from peer-representative levels is mitigated. The alert is advantageous to user entities and user devices, enabling early action to be taken by the user entity.

FIELD

This invention relates generally to systems monitoring, and moreparticularly to automated alerts when divergent resource discharging isoccurring.

BACKGROUND

Many user entities are unaware of high-level patterns in their dataflows. Conventional paper flow handling of information and resources hasbeen largely replaced by use of computerized data storage and digitaltransactions. This opens opportunities for informatics previouslyunavailable, particularly for example through machine learning andartificial intelligence (AI).

User entities are typically unaware of whether their spending divergesfrom that of their peers because transactional automated analytics isnot generally available. User entities may be disadvantaged by theproprietary and private handling of payments for costs and resources,leaving users in a common industry and/or area unaware of whether theirexpenditures in common categories are exceeding average orpeer-representative levels. Lack of such information may prevent usersfrom negotiating fair prices for resources and services.

Improvements are needed toward utilizing transactional data flows andrecord to alert user entities to any divergence in categorized spendingfrom peer-representative amounts.

BRIEF SUMMARY

Embodiments of the present invention address the above needs and/orachieve other advantages by providing a monitoring system for detectinganomalous discharges. The system includes a computing system having oneor more processor and at least one of a memory device and anon-transitory storage device. The one or more processor executescomputer-readable instructions, and a network connection operativelyconnecting user devices to the computing system. Upon execution of thecomputer-readable instructions, the computing system performs steps foreach specific user entity of multiple user entities. The steps, invarious embodiments of the system, include: storing input event recordsassociated with the specific user entity, each of the input eventrecords representing a respective quantized input event; and fetching,for at least some of the input event records, a respective inputquantity to one or more resource of the specific user entity.

The steps can further include: storing output event records associatedwith the specific user entity, each of the output event recordsrepresenting a respective quantized output event; and discharging, forat least some of the output event records, a respective output quantityfrom the one or more resource of the specific user entity.

The steps performed by the computing system can further includediscriminating, for at least some of the output event records, arespective at least one output category-specific attribute.

The computing system can associate each output event record, for which arespective at least one output category-specific attribute isdiscriminated, with each corresponding respective output category.

The computing system can aggregate, over a time interval, for eachoutput category with which output event records of the specificuser-entity are associated, a user-specific output category metric.

The steps performed by the computing system can further includedetermining, for each output category for which a user-specific outputcategory metric is aggregated, whether the user-specific output categorymetric diverges from a peer-representative output-category index.

The computing system can send an alert across the network connection fordisplay at least in part on at least one user device associated with thespecific user entity upon determining the user-specific output categorymetric diverges from a peer-representative output-category index.

The steps performed by the computing system can further includeaggregating over time, for at least one output category with whichoutput event records of multiple user-entities are associated, thepeer-representative output-category index.

Aggregating over time the peer-representative output-category index mayinclude using an aggregating algorithm trained by a machine-learningtechnique.

The aggregating algorithm may aggregate the peer-representativeoutput-category index from the output event records of the multipleuser-entities from at least one time period preceding said timeinterval.

Discriminating the respective at least one output category-specificattribute may include using a discriminating algorithm trained by amachine-learning technique.

The machine-learning technique may utilize output event records ofmultiple user-entities from at least one preceding time period to trainthe discriminating algorithm to discriminate category-specificattributes.

The machine-learning technique may utilize output event records of thespecific user entity from multiple preceding time periods to train thediscriminating algorithm to discriminate category-specific attributes.

The peer-representative output-category index may represent at least oneof an average, a mean, a normalized sum, and a weighted sum.

The steps performed by the computing system can further includedetermining the peer-representative output-category index at least inpart using third-party data.

The user-specific output category metric may represent at least one ofan average, a mean, a normalized sum, and a weighted sum.

The alert may include an indication that the user-specific outputcategory metric diverges from the peer-representative output-categoryindex by exceeding the peer-representative output-category index.

The peer-representative output-category index may be specific to ageographical location of the specific user entity.

In various embodiments, a monitoring system for detecting anomalousdischarges includes a computing system having one or more processor andat least one of a memory device and a non-transitory storage device,wherein said one or more processor executes computer-readableinstructions. A network connection operatively connects user devices tothe computing system. Upon execution of the computer-readableinstructions, the computing system performs steps for aggregating, foreach specific user entity of multiple user entities, outputuser-specific category-specific output metrics. In one or more examples,the steps include: storing input event records associated with thespecific user entity, each of the input event records representing arespective quantized input event; and fetching, for at least some of theinput event records, a respective input quantity to one or more resourceof the specific user entity.

In at least one example, the steps further include storing output eventrecords associated with the specific user entity, each of the outputevent records representing a respective quantized output event; anddischarging, for at least some of the output event records, a respectiveoutput quantity from the one or more resource of the specific userentity.

In at least one example, the steps further include discriminating, forat least some of the output event records, a respective at least oneoutput category-specific attribute.

In at least one example, the steps further include associating eachoutput event record, for which a respective at least one outputcategory-specific attribute is discriminated, with each correspondingrespective output category.

In at least one example, the steps further include aggregating, for eachspecific output category with which output event records of the specificuser-entity are associated, a user-specific category-specific outputmetric.

Upon execution of the computer-readable instructions, the computingsystem may further perform steps for detecting anomalous discharges fromone or more resource of a particular user entity of multiple userentities. The steps include aggregating a peer-representativeoutput-category index, for each particular output category with whichoutput event records of a set of multiple user-entities are associated,using the user-specific category-specific output metrics of the set ofmultiple user-entities and of the particular output category.

The steps may further include determining, for each output category withwhich output event records of a particular user entity are associated,whether the user-specific output category—specific metric for theparticular user diverges from the aggregated peer-representativeoutput-category index for the output category.

An alert is sent across the network connection for display at least inpart on at least one user device associated with the particular userentity upon determining the user-specific output category—specificmetric for the particular user diverges from the aggregatedpeer-representative output-category index for the output category.

Discriminating the respective at least one output category-specificattribute may include using a discriminating algorithm trained by amachine-learning technique.

The machine-learning technique may utilize output event records ofmultiple user-entities to train the discriminating algorithm todiscriminate category-specific attributes.

The peer-representative output-category index may represent at least oneof an average, a mean, a normalized sum, and a weighted sum.

The steps performed by the computing system can further includedetermining the peer-representative output-category index at least inpart using third-party data.

The alert may include an indication that the user-specific outputcategory-specific metric diverges from the peer-representativeoutput-category index by exceeding the peer-representativeoutput-category index.

In some embodiments, a method for a computing system to detect anomalousdischarges is provided. The computing system includes one or moreprocessor and at least one of a memory device and a non-transitorystorage device, the one or more processor configured to executecomputer-readable instructions. The method includes, in at least oneembodiment, upon execution of the computer-readable instructions, foreach specific user entity of multiple user entities: storing input eventrecords associated with the specific user entity, each of the inputevent records representing a respective quantized input event; andfetching, for at least some of the input event records, a respectiveinput quantity to one or more resource of the specific user entity.

The method may further include storing output event records associatedwith the specific user entity, each of the output event recordsrepresenting a respective quantized output event.

The method may further include discharging, for at least some of theoutput event records, a respective output quantity from the one or moreresource of the specific user entity.

The method may further include discriminating, for at least some of theoutput event records, a respective at least one output category-specificattribute.

The method may further include associating each output event record, forwhich a respective at least one output category-specific attribute isdiscriminated, with each corresponding respective output category.

The method may further include aggregating over a time interval, foreach output category with which output event records of the specificuser-entity are associated, a user-specific output category metric.

The method may further include determining, for each output category forwhich a user-specific output category metric is aggregated, whether theuser-specific output category metric diverges from a peer-representativeoutput-category index.

The method may further include sending an alert across the networkconnection for display at least in part on at least one user deviceassociated with the specific user entity upon determining theuser-specific output category metric diverges from a peer-representativeoutput-category index.

The alert may include an indication that the user-specific outputcategory metric diverges from the peer-representative output-categoryindex by exceeding the peer-representative output-category index.

The features, functions, and advantages that have been discussed may beachieved independently in various embodiments of the present inventionor may be combined in yet other embodiments, further details of whichcan be seen with reference to the following description and drawings.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

Having thus described embodiments of the invention in general terms,reference will now be made to the accompanying drawings, wherein:

FIG. 1 illustrates an enterprise system, and environment thereof,according to at least one embodiment.

FIG. 2A is a diagram of a feedforward network, according to at least oneembodiment, utilized in machine learning.

FIG. 2B is a diagram of a convolutional neural network (CNN), accordingto at least one embodiment, utilized in machine learning.

FIG. 2C is a diagram of a portion of the convolutional neural network ofFIG. 2B, according to at least one embodiment, illustrating assignedweights at connections or neurons.

FIG. 3 is a diagram representing an exemplary weighted sum computationin a node in an artificial neural network.

FIG. 4 is a diagram of a Recurrent Neural Network RNN, according to atleast one embodiment, utilized in machine learning.

FIG. 5 is a schematic logic diagram of an artificial intelligenceprogram including a front-end and a back-end algorithm.

FIG. 6 is a flow chart representing a method, according to at least oneembodiment, of model development and deployment by machine learning.

FIG. 7 represents an implementation of systems and methods for detectinganomalous discharges and alerting user entities that their user-specificand category-specific metrics are diverging from peer-representativeindexes.

FIG. 8 represents comparative analytics implemented among user entitiesin location-specific areas.

DETAILED DESCRIPTION OF EMBODIMENTS OF THE INVENTION

Embodiments of the present invention are described herein with referenceto the accompanying drawings, in which some, but not all, embodiments ofthe invention are shown. Indeed, the invention may be embodied in manydifferent forms and should not be construed as limited to theembodiments set forth herein; rather, these embodiments are provided sothat this disclosure will satisfy applicable legal requirements. Likenumbers refer to like elements throughout. Unless described or impliedas exclusive alternatives, features throughout the drawings anddescriptions should be taken as cumulative, such that features expresslyassociated with some particular embodiments can be combined with otherembodiments. Unless defined otherwise, technical and scientific termsused herein have the same meaning as commonly understood to one ofordinary skill in the art to which the presently disclosed subjectmatter pertains.

The exemplary embodiments are provided so that this disclosure will beboth thorough and complete, and will fully convey the scope of theinvention and enable one of ordinary skill in the art to make, use, andpractice the invention.

The terms “coupled,” “fixed,” “attached to,” “communicatively coupledto,” “operatively coupled to,” and the like refer to both (i) directconnecting, coupling, fixing, attaching, communicatively coupling; and(ii) indirect connecting coupling, fixing, attaching, communicativelycoupling via one or more intermediate components or features, unlessotherwise specified herein. “Communicatively coupled to” and“operatively coupled to” can refer to physically and/or electricallyrelated components.

Embodiments of the present invention described herein, with reference toflowchart illustrations and/or block diagrams of methods or apparatuses(the term “apparatus” includes systems and computer program products),will be understood such that each block of the flowchart illustrationsand/or block diagrams, and combinations of blocks in the flowchartillustrations and/or block diagrams, can be implemented by computerprogram instructions. These computer program instructions may beprovided to a processor of a general purpose computer, special purposecomputer, or other programmable data processing apparatus to produce aparticular machine, such that the instructions, which execute via theprocessor of the computer or other programmable data processingapparatus, create mechanisms for implementing the functions/actsspecified in the flowchart and/or block diagram block or blocks.

These computer program instructions may also be stored in acomputer-readable memory that can direct a computer or otherprogrammable data processing apparatus to function in a particularmanner, such that the instructions stored in the computer readablememory produce an article of manufacture including instructions, whichimplement the function/act specified in the flowchart and/or blockdiagram block or blocks.

The computer program instructions may also be loaded onto a computer orother programmable data processing apparatus to cause a series ofoperational steps to be performed on the computer or other programmableapparatus to produce a computer implemented process such that theinstructions, which execute on the computer or other programmableapparatus, provide steps for implementing the functions/acts specifiedin the flowchart and/or block diagram block or blocks. Alternatively,computer program implemented steps or acts may be combined with operatoror human implemented steps or acts in order to carry out an embodimentof the invention.

While certain exemplary embodiments have been described and shown in theaccompanying drawings, it is to be understood that such embodiments aremerely illustrative of, and not restrictive on, the broad invention, andthat this invention not be limited to the specific constructions andarrangements shown and described, since various other changes,combinations, omissions, modifications and substitutions, in addition tothose set forth in the above paragraphs, are possible. Those skilled inthe art will appreciate that various adaptations, modifications, andcombinations of the herein described embodiments can be configuredwithout departing from the scope and spirit of the invention. Therefore,it is to be understood that, within the scope of the included claims,the invention may be practiced other than as specifically describedherein.

FIG. 1 illustrates a system 100 and environment thereof, according to atleast one embodiment, by which a user 110 benefits through use ofservices and products of an enterprise system 200. The user 110 accessesservices and products by use of one or more user devices, illustrated inseparate examples as a computing device 104 and a mobile device 106,which may be, as non-limiting examples, a smart phone, a portabledigital assistant (PDA), a pager, a mobile television, a gaming device,a laptop computer, a camera, a video recorder, an audio/video player,radio, a GPS device, or any combination of the aforementioned, or otherportable device with processing and communication capabilities. In theillustrated example, the mobile device 106 is illustrated in FIG. 1 ashaving exemplary elements, the below descriptions of which apply as wellto the computing device 104, which can be, as non-limiting examples, adesktop computer, a laptop computer, or other user-accessible computingdevice.

Furthermore, the user device, referring to either or both of thecomputing device 104 and the mobile device 106, may be or include aworkstation, a server, or any other suitable device, including a set ofservers, a cloud-based application or system, or any other suitablesystem, adapted to execute, for example any suitable operating system,including Linux, UNIX, Windows, macOS, iOS, Android and any other knownoperating system used on personal computers, central computing systems,phones, and other devices.

The user 110 can be an individual, a group, or any entity in possessionof or having access to the user device, referring to either or both ofthe mobile device 104 and computing device 106, which may be personal orpublic items. Although the user 110 may be singly represented in somedrawings, at least in some embodiments according to these descriptionsthe user 110 is one of many such that a market or community of users,consumers, customers, business entities, government entities, clubs, andgroups of any size are all within the scope of these descriptions.

The user device, as illustrated with reference to the mobile device 106,includes components such as, at least one of each of a processing device120, and a memory device 122 for processing use, such as random accessmemory (RAM), and read-only memory (ROM). The illustrated mobile device106 further includes a storage device 124 including at least one of anon-transitory storage medium, such as a microdrive, for long-term,intermediate-term, and short-term storage of computer-readableinstructions 126 for execution by the processing device 120. Forexample, the instructions 126 can include instructions for an operatingsystem and various applications or programs 130, of which theapplication 132 is represented as a particular example. The storagedevice 124 can store various other data items 134, which can include, asnon-limiting examples, cached data, user files such as those forpictures, audio and/or video recordings, files downloaded or receivedfrom other devices, and other data items preferred by the user orrequired or related to any or all of the applications or programs 130.

The memory device 122 is operatively coupled to the processing device120. As used herein, memory includes any computer readable medium tostore data, code, or other information. The memory device 122 mayinclude volatile memory, such as volatile Random Access Memory (RAM)including a cache area for the temporary storage of data. The memorydevice 122 may also include non-volatile memory, which can be embeddedand/or may be removable. The non-volatile memory can additionally oralternatively include an electrically erasable programmable read-onlymemory (EEPROM), flash memory or the like.

The memory device 122 and storage device 124 can store any of a numberof applications which comprise computer-executable instructions and codeexecuted by the processing device 120 to implement the functions of themobile device 106 described herein. For example, the memory device 122may include such applications as a conventional web browser applicationand/or a mobile P2P payment system client application. Theseapplications also typically provide a graphical user interface (GUI) onthe display 140 that allows the user 110 to communicate with the mobiledevice 106, and, for example a mobile banking system, and/or otherdevices or systems. In one embodiment, when the user 110 decides toenroll in a mobile banking program, the user 110 downloads or otherwiseobtains the mobile banking system client application from a mobilebanking system, for example enterprise system 200, or from a distinctapplication server. In other embodiments, the user 110 interacts with amobile banking system via a web browser application in addition to, orinstead of, the mobile P2P payment system client application.

The processing device 120, and other processors described herein,generally include circuitry for implementing communication and/or logicfunctions of the mobile device 106. For example, the processing device120 may include a digital signal processor, a microprocessor, andvarious analog to digital converters, digital to analog converters,and/or other support circuits. Control and signal processing functionsof the mobile device 106 are allocated between these devices accordingto their respective capabilities. The processing device 120 thus mayalso include the functionality to encode and interleave messages anddata prior to modulation and transmission. The processing device 120 canadditionally include an internal data modem. Further, the processingdevice 120 may include functionality to operate one or more softwareprograms, which may be stored in the memory device 122, or in thestorage device 124. For example, the processing device 120 may becapable of operating a connectivity program, such as a web browserapplication. The web browser application may then allow the mobiledevice 106 to transmit and receive web content, such as, for example,location-based content and/or other web page content, according to aWireless Application Protocol (WAP), Hypertext Transfer Protocol (HTTP),and/or the like.

The memory device 122 and storage device 124 can each also store any ofa number of pieces of information, and data, used by the user device andthe applications and devices that facilitate functions of the userdevice, or are in communication with the user device, to implement thefunctions described herein and others not expressly described. Forexample, the storage device may include such data as user authenticationinformation, etc.

The processing device 120, in various examples, can operatively performcalculations, can process instructions for execution, and can manipulateinformation. The processing device 120 can execute machine-executableinstructions stored in the storage device 124 and/or memory device 122to thereby perform methods and functions as described or implied herein,for example by one or more corresponding flow charts expressly providedor implied as would be understood by one of ordinary skill in the art towhich the subject matters of these descriptions pertain. The processingdevice 120 can be or can include, as non-limiting examples, a centralprocessing unit (CPU), a microprocessor, a graphics processing unit(GPU), a microcontroller, an application-specific integrated circuit(ASIC), a programmable logic device (PLD), a digital signal processor(DSP), a field programmable gate array (FPGA), a state machine, acontroller, gated or transistor logic, discrete physical hardwarecomponents, and combinations thereof. In some embodiments, particularportions or steps of methods and functions described herein areperformed in whole or in part by way of the processing device 120, whilein other embodiments methods and functions described herein includecloud-based computing in whole or in part such that the processingdevice 120 facilitates local operations including, as non-limitingexamples, communication, data transfer, and user inputs and outputs suchas receiving commands from and providing displays to the user.

The mobile device 106, as illustrated, includes an input and outputsystem 136, referring to, including, or operatively coupled with, userinput devices and user output devices, which are operatively coupled tothe processing device 120. The user output devices include a display 140(e.g., a liquid crystal display or the like), which can be, as anon-limiting example, a touch screen of the mobile device 106, whichserves both as an output device, by providing graphical and text indiciaand presentations for viewing by one or more user 110, and as an inputdevice, by providing virtual buttons, selectable options, a virtualkeyboard, and other indicia that, when touched, control the mobiledevice 106 by user action. The user output devices include a speaker 144or other audio device. The user input devices, which allow the mobiledevice 106 to receive data and actions such as button manipulations andtouches from a user such as the user 110, may include any of a number ofdevices allowing the mobile device 106 to receive data from a user, suchas a keypad, keyboard, touch-screen, touchpad, microphone 142, mouse,joystick, other pointer device, button, soft key, and/or other inputdevice(s). The user interface may also include a camera 146, such as adigital camera.

Further non-limiting examples include, one or more of each, any, and allof a wireless or wired keyboard, a mouse, a touchpad, a button, aswitch, a light, an LED, a buzzer, a bell, a printer and/or other userinput devices and output devices for use by or communication with theuser 110 in accessing, using, and controlling, in whole or in part, theuser device, referring to either or both of the computing device 104 anda mobile device 106. Inputs by one or more user 110 can thus be made viavoice, text or graphical indicia selections. For example, such inputs insome examples correspond to user-side actions and communications seekingservices and products of the enterprise system 200, and at least someoutputs in such examples correspond to data representing enterprise-sideactions and communications in two-way communications between a user 110and an enterprise system 200.

The mobile device 106 may also include a positioning device 108, whichcan be for example a global positioning system device (GPS) configuredto be used by a positioning system to determine a location of the mobiledevice 106. For example, the positioning system device 108 may include aGPS transceiver. In some embodiments, the positioning system device 108includes an antenna, transmitter, and receiver. For example, in oneembodiment, triangulation of cellular signals may be used to identifythe approximate location of the mobile device 106. In other embodiments,the positioning device 108 includes a proximity sensor or transmitter,such as an RFID tag, that can sense or be sensed by devices known to belocated proximate a merchant or other location to determine that theconsumer mobile device 106 is located proximate these known devices.

In the illustrated example, a system intraconnect 138, connects, forexample electrically, the various described, illustrated, and impliedcomponents of the mobile device 106. The intraconnect 138, in variousnon-limiting examples, can include or represent, a system bus, ahigh-speed interface connecting the processing device 120 to the memorydevice 122, individual electrical connections among the components, andelectrical conductive traces on a motherboard common to some or all ofthe above-described components of the user device. As discussed herein,the system intraconnect 138 may operatively couple various componentswith one another, or in other words, electrically connects thosecomponents, either directly or indirectly—by way of intermediatecomponent(s)—with one another.

The user device, referring to either or both of the computing device 104and the mobile device 106, with particular reference to the mobiledevice 106 for illustration purposes, includes a communication interface150, by which the mobile device 106 communicates and conductstransactions with other devices and systems. The communication interface150 may include digital signal processing circuitry and may providetwo-way communications and data exchanges, for example wirelessly viawireless communication device 152, and for an additional or alternativeexample, via wired or docked communication by mechanical electricallyconductive connector 154. Communications may be conducted via variousmodes or protocols, of which GSM voice calls, SMS, EMS, MMS messaging,TDMA, CDMA, PDC, WCDMA, CDMA2000, and GPRS, are all non-limiting andnon-exclusive examples. Thus, communications can be conducted, forexample, via the wireless communication device 152, which can be orinclude a radio-frequency transceiver, a Bluetooth device, Wi-Fi device,a Near-field communication device, and other transceivers. In addition,GPS (Global Positioning System) may be included for navigation andlocation-related data exchanges, ingoing and/or outgoing. Communicationsmay also or alternatively be conducted via the connector 154 for wiredconnections such by USB, Ethernet, and other physically connected modesof data transfer.

The processing device 120 is configured to use the communicationinterface 150 as, for example, a network interface to communicate withone or more other devices on a network. In this regard, thecommunication interface 150 utilizes the wireless communication device152 as an antenna operatively coupled to a transmitter and a receiver(together a “transceiver”) included with the communication interface150. The processing device 120 is configured to provide signals to andreceive signals from the transmitter and receiver, respectively. Thesignals may include signaling information in accordance with the airinterface standard of the applicable cellular system of a wirelesstelephone network. In this regard, the mobile device 106 may beconfigured to operate with one or more air interface standards,communication protocols, modulation types, and access types. By way ofillustration, the mobile device 106 may be configured to operate inaccordance with any of a number of first, second, third, fourth,fifth-generation communication protocols and/or the like. For example,the mobile device 106 may be configured to operate in accordance withsecond-generation (2G) wireless communication protocols IS-136 (timedivision multiple access (TDMA)), GSM (global system for mobilecommunication), and/or IS-95 (code division multiple access (CDMA)), orwith third-generation (3G) wireless communication protocols, such asUniversal Mobile Telecommunications System (UMTS), CDMA2000, widebandCDMA (WCDMA) and/or time division-synchronous CDMA (TD-SCDMA), withfourth-generation (4G) wireless communication protocols such asLong-Term Evolution (LTE), fifth-generation (5G) wireless communicationprotocols, Bluetooth Low Energy (BLE) communication protocols such asBluetooth 5.0, ultra-wideband (UWB) communication protocols, and/or thelike. The mobile device 106 may also be configured to operate inaccordance with non-cellular communication mechanisms, such as via awireless local area network (WLAN) or other communication/data networks.

The communication interface 150 may also include a payment networkinterface. The payment network interface may include software, such asencryption software, and hardware, such as a modem, for communicatinginformation to and/or from one or more devices on a network. Forexample, the mobile device 106 may be configured so that it can be usedas a credit or debit card by, for example, wirelessly communicatingaccount numbers or other authentication information to a terminal of thenetwork. Such communication could be performed via transmission over awireless communication protocol such as the Near-field communicationprotocol.

The mobile device 106 further includes a power source 128, such as abattery, for powering various circuits and other devices that are usedto operate the mobile device 106. Embodiments of the mobile device 106may also include a clock or other timer configured to determine and, insome cases, communicate actual or relative time to the processing device120 or one or more other devices. For further example, the clock mayfacilitate timestamping transmissions, receptions, and other data forsecurity, authentication, logging, polling, data expiry, and forensicpurposes.

System 100 as illustrated diagrammatically represents at least oneexample of a possible implementation, where alternatives, additions, andmodifications are possible for performing some or all of the describedmethods, operations and functions. Although shown separately, in someembodiments, two or more systems, servers, or illustrated components mayutilized. In some implementations, the functions of one or more systems,servers, or illustrated components may be provided by a single system orserver. In some embodiments, the functions of one illustrated system orserver may be provided by multiple systems, servers, or computingdevices, including those physically located at a central facility, thoselogically local, and those located as remote with respect to each other.

The enterprise system 200 can offer any number or type of services andproducts to one or more users 110. In some examples, an enterprisesystem 200 offers products. In some examples, an enterprise system 200offers services. Use of “service(s)” or “product(s)” thus relates toeither or both in these descriptions. With regard, for example, toonline information and financial services, “service” and “product” aresometimes termed interchangeably. In non-limiting examples, services andproducts include retail services and products, information services andproducts, custom services and products, predefined or pre-offeredservices and products, consulting services and products, advisingservices and products, forecasting services and products, internetproducts and services, social media, and financial services andproducts, which may include, in non-limiting examples, services andproducts relating to banking, checking, savings, investments, creditcards, automatic-teller machines, debit cards, loans, mortgages,personal accounts, business accounts, account management, creditreporting, credit requests, and credit scores.

To provide access to, or information regarding, some or all the servicesand products of the enterprise system 200, automated assistance may beprovided by the enterprise system 200. For example, automated access touser accounts and replies to inquiries may be provided byenterprise-side automated voice, text, and graphical displaycommunications and interactions. In at least some examples, any numberof human agents 210, can be employed, utilized, authorized or referredby the enterprise system 200. Such human agents 210 can be, asnon-limiting examples, point of sale or point of service (POS)representatives, online customer service assistants available to users110, advisors, managers, sales team members, and referral agents readyto route user requests and communications to preferred or particularother agents, human or virtual.

Human agents 210 may utilize agent devices 212 to serve users in theirinteractions to communicate and take action. The agent devices 212 canbe, as non-limiting examples, computing devices, kiosks, terminals,smart devices such as phones, and devices and tools at customer servicecounters and windows at POS locations. In at least one example, thediagrammatic representation of the components of the user device 106 inFIG. 1 applies as well to one or both of the computing device 104 andthe agent devices 212.

Agent devices 212 individually or collectively include input devices andoutput devices, including, as non-limiting examples, a touch screen,which serves both as an output device by providing graphical and textindicia and presentations for viewing by one or more agent 210, and asan input device by providing virtual buttons, selectable options, avirtual keyboard, and other indicia that, when touched or activated,control or prompt the agent device 212 by action of the attendant agent210. Further non-limiting examples include, one or more of each, any,and all of a keyboard, a mouse, a touchpad, a joystick, a button, aswitch, a light, an LED, a microphone serving as input device forexample for voice input by a human agent 210, a speaker serving as anoutput device, a camera serving as an input device, a buzzer, a bell, aprinter and/or other user input devices and output devices for use by orcommunication with a human agent 210 in accessing, using, andcontrolling, in whole or in part, the agent device 212.

Inputs by one or more human agents 210 can thus be made via voice, textor graphical indicia selections. For example, some inputs received by anagent device 212 in some examples correspond to, control, or promptenterprise-side actions and communications offering services andproducts of the enterprise system 200, information thereof, or accessthereto. At least some outputs by an agent device 212 in some examplescorrespond to, or are prompted by, user-side actions and communicationsin two-way communications between a user 110 and an enterprise-sidehuman agent 210.

From a user perspective experience, an interaction in some exampleswithin the scope of these descriptions begins with direct or firstaccess to one or more human agents 210 in person, by phone, or onlinefor example via a chat session or website function or feature. In otherexamples, a user is first assisted by a virtual agent 214 of theenterprise system 200, which may satisfy user requests or prompts byvoice, text, or online functions, and may refer users to one or morehuman agents 210 once preliminary determinations or conditions are madeor met.

A computing system 206 of the enterprise system 200 may includecomponents such as, at least one of each of a processing device 220, anda memory device 222 for processing use, such as random access memory(RAM), and read-only memory (ROM). The illustrated computing system 206further includes a storage device 224 including at least onenon-transitory storage medium, such as a microdrive, for long-term,intermediate-term, and short-term storage of computer-readableinstructions 226 for execution by the processing device 220. Forexample, the instructions 226 can include instructions for an operatingsystem and various applications or programs 230, of which theapplication 232 is represented as a particular example. The storagedevice 224 can store various other data 234, which can include, asnon-limiting examples, cached data, and files such as those for useraccounts, user profiles, account balances, and transaction histories,files downloaded or received from other devices, and other data itemspreferred by the user or required or related to any or all of theapplications or programs 230.

The computing system 206, in the illustrated example, includes aninput/output system 236, referring to, including, or operatively coupledwith input devices and output devices such as, in a non-limitingexample, agent devices 212, which have both input and outputcapabilities.

In the illustrated example, a system intraconnect 238 electricallyconnects the various above-described components of the computing system206. In some cases, the intraconnect 238 operatively couples componentsto one another, which indicates that the components may be directly orindirectly connected, such as by way of one or more intermediatecomponents. The intraconnect 238, in various non-limiting examples, caninclude or represent, a system bus, a high-speed interface connectingthe processing device 220 to the memory device 222, individualelectrical connections among the components, and electrical conductivetraces on a motherboard common to some or all of the above-describedcomponents of the user device.

The computing system 206, in the illustrated example, includes acommunication interface 250, by which the computing system 206communicates and conducts transactions with other devices and systems.The communication interface 250 may include digital signal processingcircuitry and may provide two-way communications and data exchanges, forexample wirelessly via wireless device 252, and for an additional oralternative example, via wired or docked communication by mechanicalelectrically conductive connector 254. Communications may be conductedvia various modes or protocols, of which GSM voice calls, SMS, EMS, MMSmessaging, TDMA, CDMA, PDC, WCDMA, CDMA2000, and GPRS, are allnon-limiting and non-exclusive examples. Thus, communications can beconducted, for example, via the wireless device 252, which can be orinclude a radio-frequency transceiver, a Bluetooth device, Wi-Fi device,Near-field communication device, and other transceivers. In addition,GPS (Global Positioning System) may be included for navigation andlocation-related data exchanges, ingoing and/or outgoing. Communicationsmay also or alternatively be conducted via the connector 254 for wiredconnections such as by USB, Ethernet, and other physically connectedmodes of data transfer.

The processing device 220, in various examples, can operatively performcalculations, can process instructions for execution, and can manipulateinformation. The processing device 220 can execute machine-executableinstructions stored in the storage device 224 and/or memory device 222to thereby perform methods and functions as described or implied herein,for example by one or more corresponding flow charts expressly providedor implied as would be understood by one of ordinary skill in the art towhich the subjects matters of these descriptions pertain. The processingdevice 220 can be or can include, as non-limiting examples, a centralprocessing unit (CPU), a microprocessor, a graphics processing unit(GPU), a microcontroller, an application-specific integrated circuit(ASIC), a programmable logic device (PLD), a digital signal processor(DSP), a field programmable gate array (FPGA), a state machine, acontroller, gated or transistor logic, discrete physical hardwarecomponents, and combinations thereof.

Furthermore, the computing device 206, may be or include a workstation,a server, or any other suitable device, including a set of servers, acloud-based application or system, or any other suitable system, adaptedto execute, for example any suitable operating system, including Linux,UNIX, Windows, macOS, iOS, Android, and any known other operating systemused on personal computer, central computing systems, phones, and otherdevices.

The user devices, referring to either or both of the mobile device 104and computing device 106, the agent devices 212, and the enterprisecomputing system 206, which may be one or any number centrally locatedor distributed, are in communication through one or more networks,referenced as network 258 in FIG. 1 .

Network 258 provides wireless or wired communications among thecomponents of the system 100 and the environment thereof, includingother devices local or remote to those illustrated, such as additionalmobile devices, servers, and other devices communicatively coupled tonetwork 258, including those not illustrated in FIG. 1 . The network 258is singly depicted for illustrative convenience, but may include morethan one network without departing from the scope of these descriptions.In some embodiments, the network 258 may be or provide one or morecloud-based services or operations. The network 258 may be or include anenterprise or secured network, or may be implemented, at least in part,through one or more connections to the Internet. A portion of thenetwork 258 may be a virtual private network (VPN) or an Intranet. Thenetwork 258 can include wired and wireless links, including, asnon-limiting examples, 802.11a/b/g/n/ac, 802.20, WiMax, LTE, and/or anyother wireless link. The network 258 may include any internal orexternal network, networks, sub-network, and combinations of suchoperable to implement communications between various computingcomponents within and beyond the illustrated environment 100. Thenetwork 258 may communicate, for example, Internet Protocol (IP)packets, Frame Relay frames, Asynchronous Transfer Mode (ATM) cells,voice, video, data, and other suitable information between networkaddresses. The network 258 may also include one or more local areanetworks (LANs), radio access networks (RANs), metropolitan areanetworks (MANs), wide area networks (WANs), all or a portion of theinternet and/or any other communication system or systems at one or morelocations.

Two external systems 202 and 204 are expressly illustrated in FIG. 1 ,representing any number and variety of data sources, users, consumers,customers, business entities, banking systems, government entities,clubs, and groups of any size are all within the scope of thedescriptions. In at least one example, the external systems 202 and 204represent automatic teller machines (ATMs) utilized by the enterprisesystem 200 in serving users 110. In another example, the externalsystems 202 and 204 represent payment clearinghouse or payment railsystems for processing payment transactions, and in another example, theexternal systems 202 and 204 represent third party systems such asmerchant systems configured to interact with the user device 106 duringtransactions and also configured to interact with the enterprise system200 in back-end transactions clearing processes.

In certain embodiments, one or more of the systems such as the userdevice 106, the enterprise system 200, and/or the external systems 202and 204 are, include, or utilize virtual resources. In some cases, suchvirtual resources are considered cloud resources or virtual machines.Such virtual resources may be available for shared use among multipledistinct resource consumers and in certain implementations, virtualresources do not necessarily correspond to one or more specific piecesof hardware, but rather to a collection of pieces of hardwareoperatively coupled within a cloud computing configuration so that theresources may be shared as needed.

As used herein, an artificial intelligence system, artificialintelligence algorithm, artificial intelligence module, program, and thelike, generally refer to computer implemented programs that are suitableto simulate intelligent behavior (i.e., intelligent human behavior)and/or computer systems and associated programs suitable to performtasks that typically require a human to perform, such as tasks requiringvisual perception, speech recognition, decision-making, translation, andthe like. An artificial intelligence system may include, for example, atleast one of a series of associated if-then logic statements, astatistical model suitable to map raw sensory data into symboliccategories and the like, or a machine learning program. A machinelearning program, machine learning algorithm, or machine learningmodule, as used herein, is generally a type of artificial intelligenceincluding one or more algorithms that can learn and/or adjust parametersbased on input data provided to the algorithm. In some instances,machine learning programs, algorithms, and modules are used at least inpart in implementing artificial intelligence (AI) functions, systems,and methods.

Artificial Intelligence and/or machine learning programs may beassociated with or conducted by one or more processors, memory devices,and/or storage devices of a computing system or device. It should beappreciated that the AI algorithm or program may be incorporated withinthe existing system architecture or be configured as a standalonemodular component, controller, or the like communicatively coupled tothe system. An AI program and/or machine learning program may generallybe configured to perform methods and functions as described or impliedherein, for example by one or more corresponding flow charts expresslyprovided or implied as would be understood by one of ordinary skill inthe art to which the subjects matters of these descriptions pertain.

A machine learning program may be configured to implement storedprocessing, such as decision tree learning, association rule learning,artificial neural networks, recurrent artificial neural networks, longshort term memory networks, inductive logic programming, support vectormachines, clustering, Bayesian networks, reinforcement learning,representation learning, similarity and metric learning, sparsedictionary learning, genetic algorithms, k-nearest neighbor (KNN), andthe like. In some embodiments, the machine learning algorithm mayinclude one or more image recognition algorithms suitable to determineone or more categories to which an input, such as data communicated froma visual sensor or a file in JPEG, PNG or other format, representing animage or portion thereof, belongs. Additionally or alternatively, themachine learning algorithm may include one or more regression algorithmsconfigured to output a numerical value given an input. Further, themachine learning may include one or more pattern recognition algorithms,e.g., a module, subroutine or the like capable of translating text orstring characters and/or a speech recognition module or subroutine. Invarious embodiments, the machine learning module may include a machinelearning acceleration logic, e.g., a fixed function matrixmultiplication logic, in order to implement the stored processes and/oroptimize the machine learning logic training and interface.

One type of algorithm suitable for use in machine learning modules asdescribed herein is an artificial neural network or neural network,taking inspiration from biological neural networks. An artificial neuralnetwork can, in a sense, learn to perform tasks by processing examples,without being programmed with any task-specific rules. A neural networkgenerally includes connected units, neurons, or nodes (e.g., connectedby synapses) and may allow for the machine learning program to improveperformance. A neural network may define a network of functions, whichhave a graphical relationship. As an example, a feedforward network maybe utilized, e.g., an acyclic graph with nodes arranged in layers.

A feedforward network (see, e.g., feedforward network 260 referenced inFIG. 2A) may include a topography with a hidden layer 264 between aninput layer 262 and an output layer 266. The input layer 262, havingnodes commonly referenced in FIG. 2A as input nodes 272 for convenience,communicates input data, variables, matrices, or the like to the hiddenlayer 264, having nodes 274. The hidden layer 264 generates arepresentation and/or transformation of the input data into a form thatis suitable for generating output data. Adjacent layers of thetopography are connected at the edges of the nodes of the respectivelayers, but nodes within a layer typically are not separated by an edge.In at least one embodiment of such a feedforward network, data iscommunicated to the nodes 272 of the input layer, which thencommunicates the data to the hidden layer 264. The hidden layer 264 maybe configured to determine the state of the nodes in the respectivelayers and assign weight coefficients or parameters of the nodes basedon the edges separating each of the layers, e.g., an activation functionimplemented between the input data communicated from the input layer 262and the output data communicated to the nodes 276 of the output layer266. It should be appreciated that the form of the output from theneural network may generally depend on the type of model represented bythe algorithm. Although the feedforward network 260 of FIG. 2A expresslyincludes a single hidden layer 264, other embodiments of feedforwardnetworks within the scope of the descriptions can include any number ofhidden layers. The hidden layers are intermediate the input and outputlayers and are generally where all or most of the computation is done.

Neural networks may perform a supervised learning process where knowninputs and known outputs are utilized to categorize, classify, orpredict a quality of a future input. However, additional or alternativeembodiments of the machine learning program may be trained utilizingunsupervised or semi-supervised training, where none of the outputs orsome of the outputs are unknown, respectively. Typically, a machinelearning algorithm is trained (e.g., utilizing a training data set)prior to modeling the problem with which the algorithm is associated.Supervised training of the neural network may include choosing a networktopology suitable for the problem being modeled by the network andproviding a set of training data representative of the problem.Generally, the machine learning algorithm may adjust the weightcoefficients until any error in the output data generated by thealgorithm is less than a predetermined, acceptable level. For instance,the training process may include comparing the generated output producedby the network in response to the training data with a desired orcorrect output. An associated error amount may then be determined forthe generated output data, such as for each output data point generatedin the output layer. The associated error amount may be communicatedback through the system as an error signal, where the weightcoefficients assigned in the hidden layer are adjusted based on theerror signal. For instance, the associated error amount (e.g., a valuebetween −1 and 1) may be used to modify the previous coefficient, e.g.,a propagated value. The machine learning algorithm may be consideredsufficiently trained when the associated error amount for the outputdata is less than the predetermined, acceptable level (e.g., each datapoint within the output layer includes an error amount less than thepredetermined, acceptable level). Thus, the parameters determined fromthe training process can be utilized with new input data to categorize,classify, and/or predict other values based on the new input data.

An additional or alternative type of neural network suitable for use inthe machine learning program and/or module is a Convolutional NeuralNetwork (CNN). A CNN is a type of feedforward neural network that may beutilized to model data associated with input data having a grid-liketopology. In some embodiments, at least one layer of a CNN may include asparsely connected layer, in which each output of a first hidden layerdoes not interact with each input of the next hidden layer. For example,the output of the convolution in the first hidden layer may be an inputof the next hidden layer, rather than a respective state of each node ofthe first layer. CNNs are typically trained for pattern recognition,such as speech processing, language processing, and visual processing.As such, CNNs may be particularly useful for implementing optical andpattern recognition programs required from the machine learning program.A CNN includes an input layer, a hidden layer, and an output layer,typical of feedforward networks, but the nodes of a CNN input layer aregenerally organized into a set of categories via feature detectors andbased on the receptive fields of the sensor, retina, input layer, etc.Each filter may then output data from its respective nodes tocorresponding nodes of a subsequent layer of the network. A CNN may beconfigured to apply the convolution mathematical operation to therespective nodes of each filter and communicate the same to thecorresponding node of the next subsequent layer. As an example, theinput to the convolution layer may be a multidimensional array of data.The convolution layer, or hidden layer, may be a multidimensional arrayof parameters determined while training the model.

An exemplary convolutional neural network CNN is depicted and referencedas 280 in FIG. 2B. As in the basic feedforward network 260 of FIG. 2A,the illustrated example of FIG. 2B has an input layer 282 and an outputlayer 286. However where a single hidden layer 264 is represented inFIG. 2A, multiple consecutive hidden layers 284A, 284B, and 284C arerepresented in FIG. 2B. The edge neurons represented by white-filledarrows highlight that hidden layer nodes can be connected locally, suchthat not all nodes of succeeding layers are connected by neurons. FIG.2C, representing a portion of the convolutional neural network 280 ofFIG. 2B, specifically portions of the input layer 282 and the firsthidden layer 284A, illustrates that connections can be weighted. In theillustrated example, labels W1 and W2 refer to respective assignedweights for the referenced connections. Two hidden nodes 283 and 285share the same set of weights W1 and W2 when connecting to two localpatches.

Weight defines the impact a node in any given layer has on computationsby a connected node in the next layer. FIG. 3 represents a particularnode 300 in a hidden layer. The node 300 is connected to several nodesin the previous layer representing inputs to the node 300. The inputnodes 301, 302, 303 and 304 are each assigned a respective weight W01,W02, W03, and W04 in the computation at the node 300, which in thisexample is a weighted sum.

An additional or alternative type of feedforward neural network suitablefor use in the machine learning program and/or module is a RecurrentNeural Network (RNN). An RNN may allow for analysis of sequences ofinputs rather than only considering the current input data set. RNNstypically include feedback loops/connections between layers of thetopography, thus allowing parameter data to be communicated betweendifferent parts of the neural network. RNNs typically have anarchitecture including cycles, where past values of a parameterinfluence the current calculation of the parameter, e.g., at least aportion of the output data from the RNN may be used as feedback/input incalculating subsequent output data. In some embodiments, the machinelearning module may include an RNN configured for language processing,e.g., an RNN configured to perform statistical language modeling topredict the next word in a string based on the previous words. TheRNN(s) of the machine learning program may include a feedback systemsuitable to provide the connection(s) between subsequent and previouslayers of the network.

An example for a Recurrent Neural Network RNN is referenced as 400 inFIG. 4 . As in the basic feedforward network 260 of FIG. 2A, theillustrated example of FIG. 4 has an input layer 410 (with nodes 412)and an output layer 440 (with nodes 442). However, where a single hiddenlayer 264 is represented in FIG. 2A, multiple consecutive hidden layers420 and 430 are represented in FIG. 4 (with nodes 422 and nodes 432,respectively). As shown, the RNN 400 includes a feedback connector 404configured to communicate parameter data from at least one node 432 fromthe second hidden layer 430 to at least one node 422 of the first hiddenlayer 420. It should be appreciated that two or more and up to all ofthe nodes of a subsequent layer may provide or communicate a parameteror other data to a previous layer of the RNN network 400. Moreover andin some embodiments, the RNN 400 may include multiple feedbackconnectors 404 (e.g., connectors 404 suitable to communicatively couplepairs of nodes and/or connector systems 404 configured to providecommunication between three or more nodes). Additionally oralternatively, the feedback connector 404 may communicatively couple twoor more nodes having at least one hidden layer between them, i.e., nodesof nonsequential layers of the RNN 400.

In an additional or alternative embodiment, the machine learning programmay include one or more support vector machines. A support vectormachine may be configured to determine a category to which input databelongs. For example, the machine learning program may be configured todefine a margin using a combination of two or more of the inputvariables and/or data points as support vectors to maximize thedetermined margin. Such a margin may generally correspond to a distancebetween the closest vectors that are classified differently. The machinelearning program may be configured to utilize a plurality of supportvector machines to perform a single classification. For example, themachine learning program may determine the category to which input databelongs using a first support vector determined from first and seconddata points/variables, and the machine learning program mayindependently categorize the input data using a second support vectordetermined from third and fourth data points/variables. The supportvector machine(s) may be trained similarly to the training of neuralnetworks, e.g., by providing a known input vector (including values forthe input variables) and a known output classification. The supportvector machine is trained by selecting the support vectors and/or aportion of the input vectors that maximize the determined margin.

As depicted, and in some embodiments, the machine learning program mayinclude a neural network topography having more than one hidden layer.In such embodiments, one or more of the hidden layers may have adifferent number of nodes and/or the connections defined between layers.In some embodiments, each hidden layer may be configured to perform adifferent function. As an example, a first layer of the neural networkmay be configured to reduce a dimensionality of the input data, and asecond layer of the neural network may be configured to performstatistical programs on the data communicated from the first layer. Invarious embodiments, each node of the previous layer of the network maybe connected to an associated node of the subsequent layer (denselayers). Generally, the neural network(s) of the machine learningprogram may include a relatively large number of layers, e.g., three ormore layers, and are referred to as deep neural networks. For example,the node of each hidden layer of a neural network may be associated withan activation function utilized by the machine learning program togenerate an output received by a corresponding node in the subsequentlayer. The last hidden layer of the neural network communicates a dataset (e.g., the result of data processed within the respective layer) tothe output layer. Deep neural networks may require more computationaltime and power to train, but the additional hidden layers providemultistep pattern recognition capability and/or reduced output errorrelative to simple or shallow machine learning architectures (e.g.,including only one or two hidden layers).

Referring now to FIG. 5 and some embodiments, an AI program 502 mayinclude a front-end algorithm 504 and a back-end algorithm 506. Theartificial intelligence program 502 may be implemented on an AIprocessor 520, such as the processing device 120, the processing device220, and/or a dedicated processing device. The instructions associatedwith the front-end algorithm 504 and the back-end algorithm 506 may bestored in an associated memory device and/or storage device of thesystem (e.g., memory device 124 and/or memory device 224)communicatively coupled to the AI processor 520, as shown. Additionallyor alternatively, the system may include one or more memory devicesand/or storage devices (represented by memory 524 in FIG. 5 ) forprocessing use and/or including one or more instructions necessary foroperation of the AI program 502. In some embodiments, the AI program 502may include a deep neural network (e.g., a front-end network 504configured to perform pre-processing, such as feature recognition, and aback-end network 506 configured to perform an operation on the data setcommunicated directly or indirectly to the back-end network 506). Forinstance, the front-end program 506 can include at least one CNN 508communicatively coupled to send output data to the back-end network 506.

Additionally or alternatively, the front-end program 504 can include oneor more AI algorithms 510, 512 (e.g., statistical models or machinelearning programs such as decision tree learning, associate rulelearning, recurrent artificial neural networks, support vector machines,and the like). In various embodiments, the front-end program 504 may beconfigured to include built in training and inference logic or suitablesoftware to train the neural network prior to use (e.g., machinelearning logic including, but not limited to, image recognition, mappingand localization, autonomous navigation, speech synthesis, documentimaging, or language translation). For example, a CNN 508 and/or AIalgorithm 510 may be used for image recognition, input categorization,and/or support vector training. In some embodiments and within thefront-end program 504, an output from an AI algorithm 510 may becommunicated to a CNN 508 or 509, which processes the data beforecommunicating an output from the CNN 508, 509 and/or the front-endprogram 504 to the back-end program 506. In various embodiments, theback-end network 506 may be configured to implement input and/or modelclassification, speech recognition, translation, and the like. Forinstance, the back-end network 506 may include one or more CNNs (e.g.,CNN 514) or dense networks (e.g., dense networks 516), as describedherein.

For instance and in some embodiments of the AI program 502, the programmay be configured to perform unsupervised learning, in which the machinelearning program performs the training process using unlabeled data,e.g., without known output data with which to compare. During suchunsupervised learning, the neural network may be configured to generategroupings of the input data and/or determine how individual input datapoints are related to the complete input data set (e.g., via thefront-end program 504). For example, unsupervised training may be usedto configure a neural network to generate a self-organizing map, reducethe dimensionally of the input data set, and/or to performoutlier/anomaly determinations to identify data points in the data setthat falls outside the normal pattern of the data. In some embodiments,the AI program 502 may be trained using a semi-supervised learningprocess in which some but not all of the output data is known, e.g., amix of labeled and unlabeled data having the same distribution.

In some embodiments, the AI program 502 may be accelerated via a machinelearning framework 520 (e.g., hardware). The machine learning frameworkmay include an index of basic operations, subroutines, and the like(primitives) typically implemented by AI and/or machine learningalgorithms. Thus, the AI program 502 may be configured to utilize theprimitives of the framework 520 to perform some or all of thecalculations required by the AI program 502. Primitives suitable forinclusion in the machine learning framework 520 include operationsassociated with training a convolutional neural network (e.g., pools),tensor convolutions, activation functions, basic algebraic subroutinesand programs (e.g., matrix operations, vector operations), numericalmethod subroutines and programs, and the like.

It should be appreciated that the machine learning program may includevariations, adaptations, and alternatives suitable to perform theoperations necessary for the system, and the present disclosure isequally applicable to such suitably configured machine learning and/orartificial intelligence programs, modules, etc. For instance, themachine learning program may include one or more long short-term memory(LSTM) RNNs, convolutional deep belief networks, deep belief networksDBNs, and the like. DBNs, for instance, may be utilized to pre-train theweighted characteristics and/or parameters using an unsupervisedlearning process. Further, the machine learning module may include oneor more other machine learning tools (e.g., Logistic Regression (LR),Naive-Bayes, Random Forest (RF), matrix factorization, and supportvector machines) in addition to, or as an alternative to, one or moreneural networks, as described herein.

FIG. 6 is a flow chart representing a method 600, according to at leastone embodiment, of model development and deployment by machine learning.The method 600 represents at least one example of a machine learningworkflow in which steps are implemented in a machine learning project.

In step 602, a user authorizes, requests, manages, or initiates themachine-learning workflow. This may represent a user such as humanagent, or customer, requesting machine-learning assistance or AIfunctionality to simulate intelligent behavior (such as a virtual agent)or other machine-assisted or computerized tasks that may, for example,entail visual perception, speech recognition, decision-making,translation, forecasting, predictive modelling, and/or suggestions asnon-limiting examples. In a first iteration from the user perspective,step 602 can represent a starting point. However, with regard tocontinuing or improving an ongoing machine learning workflow, step 602can represent an opportunity for further user input or oversight via afeedback loop.

In step 604, data is received, collected, accessed, or otherwiseacquired and entered as can be termed data ingestion. In step 606, thedata ingested in step 604 is pre-processed, for example, by cleaning,and/or transformation such as into a format that the followingcomponents can digest. The incoming data may be versioned to connect adata snapshot with the particularly resulting trained model. As newlytrained models are tied to a set of versioned data, preprocessing stepsare tied to the developed model. If new data is subsequently collectedand entered, a new model will be generated. If the preprocessing step606 is updated with newly ingested data, an updated model will begenerated. Step 606 can include data validation, which focuses onconfirming that the statistics of the ingested data are as expected,such as that data values are within expected numerical ranges, that datasets are within any expected or required categories, and that datacomply with any needed distributions such as within those categories.Step 606 can proceed to step 608 to automatically alert the initiatinguser, other human or virtual agents, and/or other systems, if anyanomalies are detected in the data, thereby pausing or terminating theprocess flow until corrective action is taken.

In step 610, training test data such as a target variable value isinserted into an iterative training and testing loop. In step 612, modeltraining, a core step of the machine learning work flow, is implemented.A model architecture is trained in the iterative training and testingloop. For example, features in the training test data are used to trainthe model based on weights and iterative calculations in which thetarget variable may be incorrectly predicted in an early iteration asdetermined by comparison in step 614, where the model is tested.Subsequent iterations of the model training, in step 612, may beconducted with updated weights in the calculations.

When compliance and/or success in the model testing in step 614 isachieved, process flow proceeds to step 616, where model deployment istriggered. The model may be utilized in AI functions and programming,for example to simulate intelligent behavior, to performmachine-assisted or computerized tasks, of which visual perception,speech recognition, decision-making, translation, forecasting,predictive modelling, and/or automated suggestion generation serve asnon-limiting examples.

FIG. 7 represents an implementation of systems and methods for detectinganomalous discharges and alerting user entities that their user-specificand category-specific metrics are diverging from peer-representativeindexes. In the illustrated example, a user entity 110 can be aproprietor, employee, manager, managing group, a corporation, or otherinterested party with regard to a business 700. The business 700 canoffer any number or type of services and products. In some examples, thebusiness 700 offers products 702 as graphically represented in FIG. 7 .In other examples, the business offers services. Use of “service(s)” or“product(s)” thus relates to either or both in these descriptions. Withregard, for example, to online information and services, “service” and“product” are sometimes termed interchangeably.

The interests, assets, obligations, profits, and liabilities of thebusiness 700 are those of, or are managed at least in part by, the userentity 110. Accordingly, the business 700 and user entity 110 may betermed interchangeably herein. The business 700 may have a “brick andmortar” facility 701 as illustrated in FIG. 7 , denoting a business thatoperates one or more physical facilities where, for example, productfabrication and point-of-sale (POS) transactions (sales) with customersare conducted or services rendered. Additionally, or alternatively, allvariations of which are within the scope of these descriptions, thebusiness 700 may conduct business online or virtually, in whole or inpart. For example, the business may conduct order fulfillment withoutphysically stocking and handling products and services, insteadpurchasing inventory as needed from another party or parties, such as awholesaler or manufacture, to fulfill orders by shipment directly orindirectly to customers.

The business 700 operates with multiple costs, shown generallythroughout FIG. 7 with corresponding indicia (−$). The business hasincome, for example according to sales of the product 702, showngenerally throughout FIG. 7 with corresponding indicia (+$). FIG. 7illustrates, all representing respective costs (−$), incoming materialsupplies 704, utilities like power 706 and water 710, maintenance andrepairs 712, transportation costs 714 with respect to productdeliveries, advertising 716, payroll 720 for employees 722, travelreimbursements 724, health insurance premiums and other medical-relatedexpenditures 726, and costs for training or education 730. Each of theseexpenditures (−$) can be paid via, for example, checks 732 drafted bythe user entity, whether checks be in paper form or electronic. Theexpenditures can be paid by use of credit cards 734, and debit cards736, and other payment types. These and other transactions can beconducted, for example, online using user devices, represented as acomputing device 104 and a mobile device 106 in FIGS. 1 and 7 .

According to systems and methods described herein, in at least someembodiments, an entity, referenced as a service entity 740 in FIG. 7 ,provides a service to the user entity 110 and/or business 700 by use ofthe enterprise system 200 (FIG. 1 ) and network 258. For example, by useof the computing system 206, the service entity 740 provides systems andmethods for detecting anomalous discharges and alerting user entitiesthat their user-specific and category-specific metrics are divergingfrom peer-representative indexes. The service entity 740 can bedescribed as an enterprise entity, a business entity, a retailer, amerchant entity, a financial institution, a bank, or other serviceand/or product provider. The service entity 740 can access client dataheld, acquired, and/or stored for example as described above withreference to the storage device 224 of FIG. 1 and data 234 storedtherein. The service entity 740, in some examples, can also utilizeavailable other party data that can be purchased and/or otherwiseacquired, for example as described above with reference to the externalsystems 202 and 204 of FIG. 1 .

In the non-limiting example of FIG. 7 , timestamped events representing,for example, deposits 742 into and payments 744 made out of accounts 746of the user entity 110 and/or business 700 are recorded. Determinationsare made as to whether categorized expenditures, sometimes termed asdischarges herein, are diverging from those of peers thus indicatingexposure of a user entity to excess charges or inefficiencies inarrangements with vendors, suppliers, advertisers, service providers,and employees, as non-limiting examples. Typical output categories arerepresented in FIG. 7 by: incoming material supplies 704; power 706;water 710, maintenance and repairs 712, transportation costs 714;advertising 716; payroll 720 for employees 722; travel reimbursements724; health insurance premiums and other medical-related expenditures726; and costs for training or education 730. Other output categoriesare within the scope of these descriptions.

When such exposure is determined, the user entity 110 and/or business700, collectively termed as user entity 110 in the following, receivesan alert 750. The alert 750 is displayed by the user device for viewingby the user at the computing device 104 and/or the mobile device 106.The inter-entity exposure, for example the risk that output metrics arediverging from those of peers, is thus mitigated. Whether or notsolutioning services are offered, the alert 750 is advantageous to userentities and user devices, enabling early action to be taken by the userentity.

In some examples, a computing system of the service entity 740 usesartificial intelligence (AI) on transactions in the business accounts ofsmall business clients. The user entity 110 may be a client of theservice entity 740. The service entity 740 may maintain, oversee, manageand or monitor the accounts 746, representing any and/or all of accountsfor and/or related to checking, savings, investments, credit cards,automatic-teller machines, debit cards, loans, mortgages, personalaccounts, and business accounts as non-limiting examples.

In the illustrated example of FIG. 7 , the expenditures (−$) can bedescribed as quantized output events for which corresponding respectiveoutput quantities are discharged from one or more user account 746 tosatisfy cost-related payments, referring to the satisfaction of outgoingchecks, incoming debit card charges, credit card charges, and otherpayments made by or on behalf of the user entity 110 in covering costs.

The revenues (+$) can be described as quantized input events for whichcorresponding respective input quantities are fetched from sources fordeposit into one or more user account 746. For example, revenue (+$)from sales deposited to the one or more user account 746 representrespective quantized input events for which records are stored withregard to the accounts to which corresponding input quantities arefetched.

For a small business in one example, a net profit according to the sumof fetched increments (+$) less the sum of discharged decrements (−$) isessentially income for the proprietor. Thus, where expenditures inoutput categories are exceeding those of peer-representative amounts,small businesses and proprietors can be immediately and/or directlyaffected. Fetching refers to receiving and crediting cash deposits, andto the satisfaction of deposited or incoming checks from other parties,debit card charges, credit card charges, and other payments made to orexacted by the user entity 110 in receiving payments for products and/orservices as non-limiting examples.

Notifications such as the alert 750 may be made by way of acommunication application, for example referenced as application 132 inFIG. 1 , provided by the service entity 740 and installed on the one ormore user device 104 and 106. Clients may be segmented into differentcategories such as retail banking clients, premier banking clients,wealth clients, small business clients, and commercial clients.Communication to each would look different depending on the type ofclient and their selected or inferred preferences. Small business andsole proprietors are likely among those to find significant benefits inthe various services described herein.

The alert 750 and accompanying or subsequent information and messagingcan be customized for each particular user entity or user category. Ahuman agent 210, and/or a virtual agent 214, may be engaged incommunications preceding, accompanying, or subsequent to the alert 750.The user entity 110 may conduct transactions via the one or more userdevices 104 and 106 and may visit a branch office of the service entity740 and conduct transactions at a kiosk or counter. A human agent 210,and/or a virtual agent 214 may be informed with user preferences as togreetings and with awareness of what stage the user entity may be atwith regard to the alert 750 and consideration of offers of mitigationsolutions made available by the service entity 740.

In embodiments of methods and systems according to these descriptions,transactional analysis is conducted, for example focusing on smallbusiness outbound payments, to help user entities better understandtheir cash flow, to find where overspending may be occurring, and whereunderspending may be occurring. In income relation to their peers. Inone example, two user entities may have similar business models, andtheir sales volumes are similar. Data analytics applied to theirrespective expenditure flows may uncover disparate lease paymentsdespite operating in the same market, even nearby each other. Theservice entity 740 described herein may report peer-divergent spendingin a category, for example in utilities. By informing a business entityof the divergence, the entity is better empowered to act to balanceexpenditures with fair market values.

Where sales volume among entities are similar, costs of goods andoperating expenses should be similar. Systems and methods describedherein can help user entities identify whether expenditures are peerdivergent, and predict what expenditures might be if balanced with themarket. User entities acting on the information thus provided, canimprove operations and their costs in relation to their revenue.

In some examples, user entities have primacy, referring to the serviceentity 740 being primary in handling financial flows and transactionaldata. In such cases, the service entity 740 has direct access totransactional data for credit transactions, checking transactions, andother transaction types. More detailed information from checkingtransactions than incoming and outgoing amounts can be gained fromingesting data via OCR analysis on checks, whether in paper or scannedform.

Comparative analytics can be conducted among user entities in a commonindustry, such as restaurants, convenience stores, landscapingcompanies, beauty salons, barbers, car repairs, as non-limitingexamples. Comparative analytics can be conducted among user entities ina common location area, such as a neighborhood, a city, a county, astate, and a country, as non-limiting examples.

Information reported to user entities resulting from the analysis may befree of identifying information from other entities to preserveconfidential information and expectations of data privacy. The serviceentity 740 may provide the aggregate of multi-entity transactions anddetermine a mean, or an average of categorized transactions across apeer-group or a number of entities in a common industry, and error ratesor statistical deviations can be determined. The service entity 740 maynormalize the data. For example, if sizable margins of error are seen inone industry or another, normalization can be applied.

A seamless process of transactional automated analytics is provided.User entities provided alerts of category spending diverging from thatof their peers, for example on employee benefits, or transportation, arebetter enabled to take action. If an entity is alerted tocategory-specific over paying relative to peers, the entity can use thatinformation to seek lower pricing for category-specific goods andservice. For example, a user entity may be able to then negotiate betterrates with suppliers.

Time intervals for sampling and reporting/alerting can vary to providereal time feedback or near real time feedback. Industry-reported orpublished data may be made available in a delayed fashion, such that forexample, published peer-representative averages and indexes may be ayear old by the time data is accumulated and made available viaconventional means. Systems and methods described herein can provideuser entities with more timely information, especially for example whenpeer data is immediately available to the service entity 740 throughprimacy of multiple user entities in common industries and areas.

The above-described benefits and advantages are provided in variousembodiments of the enterprise system 200 of FIG. 1 , which can bedescribed as a monitoring system for detecting anomalous discharges. Thesystem 200 includes a computing system 206 having one or more processor220 and at least one of a memory device 222 and a non-transitory storagedevice 224. The one or more processor executes computer-readableinstructions 226, and a network connection 258 operatively connectinguser devices 104 and 106 to the computing system. Upon execution of thecomputer-readable instructions, the computing system performs steps foreach specific user entity 110 of multiple user entities.

The steps, in various embodiments of the system 200, include: storinginput event records associated with the specific user entity, each ofthe input event records representing a respective quantized input event;and fetching, for at least some of the input event records, a respectiveinput quantity to one or more resource of the specific user entity. InFIG. 7 , the revenues (+$) represent quantized input events for whichcorresponding input quantities are fetched from sources for deposit intoone or more user account 746, for which records are stored with regardto the accounts to which the input quantities are fetched.

The steps can further include: storing output event records associatedwith the specific user entity, each of the output event recordsrepresenting a respective quantized output event; and discharging, forat least some of the output event records, a respective output quantityfrom the one or more resource of the specific user entity. In FIG. 7 ,the expenditures (−$) represent quantized output events for whichcorresponding respective output quantities are discharged from one ormore user account 746, for which records are stored with regard to theaccounts from which corresponding output quantities are discharged.

The computing system 206, in some examples, can implementdiscriminating, for at least some of the output event records, arespective output category-specific attribute. Category-specificattributes serve to identify payments made for particular categoryexpenditures. For example, utility costs categorized as power 706 andwater 710 as referenced in FIG. 7 can be identified by the identities ofthe utility-entity recipients of the payments, thus recipient accountscan serve as category-specific attributes. Other attributes can be foundin the keywords present in web sites, metadata, tags, or other availablecontent sources regarding the products and/or services available fromthe recipients of the payments (−$) made by the user entity 110. Theseexamples of category-specific attributes, generally referring toindicators by which output categories are identified, are within thescope of these descriptions. In at least one embodiment of systems andmethods described herein, a discriminating algorithm is trained by amachine-learning technique and used to discriminate outputcategory-specific attributes. The machine-learning technique may utilizeoutput event records of multiple user-entities, for example from one ormore previous time period, to train the discriminating algorithm todiscriminate category-specific attributes.

The computing system 206 can associate each output event record, forwhich a respective at least one output category-specific attribute isdiscriminated, with each corresponding respective output category. Thus,category-specific payment records can be later identified for comparisonamong user entities, or more particularly, to facilitate theaccumulating of averages and such.

The computing system 206 can aggregate, over a time interval, for eachoutput category with which output event records of the specificuser-entity are associated, a user-specific output category metric. Theuser-specific output category metric represents category-specificspending for the user entity, for example, in the particular timeinterval, as a total, or as a computed quantity by which the spending ofthe user entity in a category can be compared with same category peerspending.

The computing system 206 can further include determining, for eachoutput category for which a user-specific output category metric isaggregated, whether the user-specific output category metric divergesfrom a peer-representative output-category index. Thepeer-representative category metric represents peer spending in aparticular category, and serves as a basis by which a determination asto whether a user entity is overspending in any category. Theuser-specific output category metric may include or represent anaverage, a mean, a normalized sum, and/or a weighted sum, asnon-limiting examples.

The computing system 206 sends an alert, referenced for example in FIG.6 as alert 750, across the network connection 258 for display at leastin part on at least one user device associated with the specific userentity 110 upon determining the user-specific output category metricdiverges from a peer-representative output-category index. User devicerefers to the computing device 104 and/or the mobile device 106 and/orany other devices available or accessible to the user entity. The alert750, in various examples, indicates that the user-specific outputcategory metric diverges from the peer-representative output-categoryindex by exceeding the peer-representative output-category index. Userentity exposure to category-specific overspending is mitigated by thealert 750.

The peer-representative output-category index for any or all outputcategories may be determined by the computing system, in whole or inpart, from the transactional data available from the multiple userentities which records are stored by the service entity. The computingsystem can aggregate over time, for any given output category with whichoutput event records of multiple user-entities are associated, thepeer-representative output-category index. For any output category, someoutput categories, or all output categories, other available data may beused in lieu of or in combination with the transactional data availablefrom the multiple user entities for which records are stored by theservice entity. Industry-reported or published data may be madeavailable such that for example, published peer-representative averagesand indexes may be used to supplement user data. Thus, the computingsystem can access and utilize third-party data in determining thepeer-representative output-category index.

In at least some examples, the computing system 206 aggregates over timethe peer-representative output-category index using an aggregatingalgorithm trained by a machine-learning technique, for example asrepresented in FIG. 6 . In at least one example, the machine-learningtechnique utilizes records, of multiple user entities, from prior timeintervals to calculate the peer-representative output-category index. Atrained model, in at least one embodiment, is built using historicaldata of the user entity and that of other user entities. In the exampleof FIG. 7 , in which user entity exposure to category-specificoverspending is mitigated by the alert 750, model training asimplemented in FIG. 6 data from multiple user entities to train a modelby which user spending in multiple output categories can be compared torespective peer-spending amounts. The machine-learning technique can beapplied to any of the simulated neural network architectures describedhere with reference to FIGS. 2A-5 for implementation in calculationsdescribed with reference to FIG. 7 .

The aggregating algorithm may aggregate the peer-representativeoutput-category index from the output event records of the multipleuser-entities from at least one time period preceding said timeinterval. The output event records of multiple time periods may be usedin order to implement normalization against spurious market increasesand decreases. The peer-representative output-category index mayrepresent, for example, an average, a mean, a normalized sum, and aweighted sum.

The peer-representative output-category index may be specific to ageographical location of the specific user entity. For example, asrepresented in FIG. 8 , the business 700 of a user entity 110 has aphysical location in a particular geographical area 708, bounded bydashed line in FIG. 8 for illustration. The area 708 can represent aneighborhood, a city, a county, a state, and a country, as non-limitingexamples. Comparative analytics can be implemented among user entitybusinesses 700, 700B, and 700C in the geographical area 708. In theillustrated example, a location-specific peer-representativeoutput-category index for a particular output-spending category isdetermined or obtained for the area 708. A different location-specificpeer-representative output-category index may be determined or obtainedfor any particular output-spending category for a different area 718,which is shown as neighboring or bordering the area 708 in FIG. 8 . Areaspecificity in peer-representative output-category indexes may be ofparticular advantage in output categories such as land leases,advertising, and other spending categories in which location is adeterminative factor in costs. For example in FIG. 8 , at least somecomparative analytics are implemented among user entity businesses 700,700B, and 700C in the geographical area 708 for alerting the user entity110 to category-specific and location-specific overspending. Similarly,at least some comparative analytics are implemented among user entitybusinesses 700D, 700E, and 700F in the geographical area 718 foralerting respective entities to category-specific and location-specificoverspending in their area.

FIG. 8 also represents that user entities representing or represented bythe businesses 700, 700B and 700C in the area 708 may conducttransactions via respective one or more user device and may visit anearby branch office 738 of the service entity 740 and conducttransactions at a kiosk or counter. Similarly, user entitiesrepresenting or represented by the businesses 700D, 700E and 700F in thearea 718 may conduct transactions via respective one or more user deviceand may visit a nearby branch office 748 of the service entity 740 andconduct transactions at a kiosk or counter.

Particular embodiments and features have been described with referenceto the drawings. It is to be understood that these descriptions are notlimited to any single embodiment or any particular set of features.Similar embodiments and features may arise or modifications andadditions may be made without departing from the scope of thesedescriptions and the spirit of the appended claims.

What is claimed is:
 1. A monitoring system for detecting anomalousdischarges, the monitoring system comprising: a computing systemincluding one or more processor and at least one of a memory device anda non-transitory storage device, wherein said one or more processorexecutes computer-readable instructions; and a network connectionoperatively connecting user devices to the computing system, wherein,upon execution of the computer-readable instructions, the computingsystem performs steps comprising, for each specific user entity ofmultiple user entities: storing input event records associated with thespecific user entity, each of the input event records representing arespective quantized input event; fetching, for at least some of theinput event records, a respective input quantity to one or more resourceof the specific user entity; storing output event records associatedwith the specific user entity, each of the output event recordsrepresenting a respective quantized output event; discharging, for atleast some of the output event records, a respective output quantityfrom the one or more resource of the specific user entity;discriminating, for at least some of the output event records, arespective at least one output category-specific attribute; associatingeach output event record, for which a respective at least one outputcategory-specific attribute is discriminated, with each correspondingrespective output category; aggregating over a time interval, for eachoutput category with which output event records of the specificuser-entity are associated, a user-specific output category metric;determining, for each output category for which a user-specific outputcategory metric is aggregated, whether the user-specific output categorymetric diverges from a peer-representative output-category index; andsending an alert across the network connection for display at least inpart on at least one user device associated with the specific userentity upon determining the user-specific output category metricdiverges from a peer-representative output-category index.
 2. Themonitoring system of claim 1, the steps further comprising aggregatingover time, for at least one output category with which output eventrecords of multiple user-entities are associated, thepeer-representative output-category index.
 3. The monitoring system ofclaim 2, wherein aggregating over time the peer-representativeoutput-category index comprises using an aggregating algorithm trainedby a machine-learning technique.
 4. The monitoring system of claim 3,wherein the aggregating algorithm aggregates the peer-representativeoutput-category index from the output event records of the multipleuser-entities from at least one time period preceding said timeinterval.
 5. The monitoring system of claim 1, wherein discriminatingthe respective at least one output category-specific attribute comprisesusing a discriminating algorithm trained by a machine-learningtechnique.
 6. The monitoring system of claim 5, wherein themachine-learning technique utilizes output event records of multipleuser-entities from at least one time period preceding said time intervalto train the discriminating algorithm to discriminate category-specificattributes.
 7. The monitoring system of claim 5, wherein themachine-learning technique utilizes output event records of the specificuser entity from multiple time periods preceding said time interval totrain the discriminating algorithm to discriminate category-specificattributes.
 8. The monitoring system of claim 1, wherein thepeer-representative output-category index represents at least one of: anaverage; a mean; a normalized sum; and a weighted sum.
 9. The monitoringsystem of claim 1, the steps further comprising determining thepeer-representative output-category index at least in part usingthird-party data.
 10. The monitoring system of claim 1, wherein theuser-specific output category metric represents at least one of: anaverage; a mean; a normalized sum; and a weighted sum.
 11. Themonitoring system of claim 1, wherein the alert comprises an indicationthat the user-specific output category metric diverges from thepeer-representative output-category index by exceeding thepeer-representative output-category index.
 12. The monitoring system ofclaim 1, wherein the peer-representative output-category index isspecific to a geographical location of the specific user entity.
 13. Amonitoring system for detecting anomalous discharges, the monitoringsystem comprising: a computing system including one or more processorand at least one of a memory device and a non-transitory storage device,wherein said one or more processor executes computer-readableinstructions; and a network connection operatively connecting userdevices to the computing system, wherein, upon execution of thecomputer-readable instructions, the computing system performs steps foraggregating, for each specific user entity of multiple user entities,output user-specific category-specific output metrics, the stepscomprising: storing input event records associated with the specificuser entity, each of the input event records representing a respectivequantized input event; fetching, for at least some of the input eventrecords, a respective input quantity to one or more resource of thespecific user entity; storing output event records associated with thespecific user entity, each of the output event records representing arespective quantized output event; discharging, for at least some of theoutput event records, a respective output quantity from the one or moreresource of the specific user entity; discriminating, for at least someof the output event records, a respective at least one outputcategory-specific attribute; associating each output event record, forwhich a respective at least one output category-specific attribute isdiscriminated, with each corresponding respective output category; andaggregating, for each specific output category with which output eventrecords of the specific user-entity are associated, a user-specificcategory-specific output metric, wherein, upon execution of thecomputer-readable instructions, the computing system further performssteps for detecting anomalous discharges from one or more resource of aparticular user entity of multiple user entities, the steps comprising:aggregating a peer-representative output-category index, for eachparticular output category with which output event records of a set ofmultiple user-entities are associated, using the user-specificcategory-specific output metrics of the set of multiple user-entitiesand of the particular output category; determining, for each outputcategory with which output event records of a particular user entity areassociated, whether the user-specific output category—specific metricfor the particular user diverges from the aggregated peer-representativeoutput-category index for the output category; and sending an alertacross the network connection for display at least in part on at leastone user device associated with the particular user entity upondetermining the user-specific output category—specific metric for theparticular user diverges from the aggregated peer-representativeoutput-category index for the output category.
 14. The monitoring systemof claim 13, wherein discriminating the respective at least one outputcategory-specific attribute comprises using a discriminating algorithmtrained by a machine-learning technique.
 15. The monitoring system ofclaim 14, wherein the machine-learning technique utilizes output eventrecords of multiple user-entities to train the discriminating algorithmto discriminate category-specific attributes.
 16. The monitoring systemof claim 13, wherein the peer-representative output-category indexrepresents at least one of: an average; a mean; a normalized sum; and aweighted sum.
 17. The monitoring system of claim 13, the steps furthercomprising determining the peer-representative output-category index atleast in part using third-party data.
 18. The monitoring system of claim13, wherein the alert comprises an indication that the user-specificoutput category-specific metric diverges from the peer-representativeoutput-category index by exceeding the peer-representativeoutput-category index.
 19. A method for a computing system to detectanomalous discharges, the computing system including one or moreprocessor and at least one of a memory device and a non-transitorystorage device, the one or more processor configured to executecomputer-readable instructions, the method comprising, upon execution ofthe computer-readable instructions, for each specific user entity ofmultiple user entities: storing input event records associated with thespecific user entity, each of the input event records representing arespective quantized input event; fetching, for at least some of theinput event records, a respective input quantity to one or more resourceof the specific user entity; storing output event records associatedwith the specific user entity, each of the output event recordsrepresenting a respective quantized output event; discharging, for atleast some of the output event records, a respective output quantityfrom the one or more resource of the specific user entity;discriminating, for at least some of the output event records, arespective at least one output category-specific attribute; associatingeach output event record, for which a respective at least one outputcategory-specific attribute is discriminated, with each correspondingrespective output category; aggregating over a time interval, for eachoutput category with which output event records of the specificuser-entity are associated, a user-specific output category metric;determining, for each output category for which a user-specific outputcategory metric is aggregated, whether the user-specific output categorymetric diverges from a peer-representative output-category index; andsending an alert across the network connection for display at least inpart on at least one user device associated with the specific userentity upon determining the user-specific output category metricdiverges from a peer-representative output-category index.
 20. Themonitoring system of claim 1, wherein the alert comprises an indicationthat the user-specific output category metric diverges from thepeer-representative output-category index by exceeding thepeer-representative output-category index.